Disclosure policy
What we handle, what we do not, and what happens to your report.
Scope
This policy only covers websites whose /.well-known/security.txt file points to this page.
Out of scope: e-mail, networks, workstations and internal systems of the owners of these websites, as well as third-party services (hosting providers, CDNs, SaaS tools, social networks). Out-of-scope reports are not processed.
Rules
- No denial of service, load testing or mass automated scanning.
- No social engineering, phishing or physical intrusion.
- Do not access, modify or delete data beyond what is strictly necessary to demonstrate the issue.
- Do not disclose the issue publicly before it is fixed.
This policy does not constitute an authorisation to test the systems concerned. WNG SA does not own its clients’ websites and cannot make any legal commitment on their behalf.
No reward
There is no bug bounty programme. No report is rewarded financially, whatever its severity. Payment requests are left unanswered.
Reports not accepted
- Missing HTTP security headers without a demonstrated exploit.
- SPF, DKIM, DMARC or DNSSEC configuration.
- Software version or banner disclosure.
- TLS configuration (cipher suites, protocol versions) without a practical attack.
- Clickjacking on pages without sensitive actions, self-XSS, logout CSRF.
- Missing rate limiting, user enumeration without demonstrated impact.
- Raw output of automated scanners without manual verification.
Handling
Every in-scope report is reviewed by the WNG SA technical team. We only contact you if we need further details and you provided an e-mail address. No response or remediation time is guaranteed.
Data protection
The form content is sent by e-mail to WNG SA (Switzerland) and is not stored on this server. Your IP address is not attached to the report; it is used in hashed form, for one hour at most, to limit abuse. Name and e-mail address are optional and are used solely to follow up on the report.
This website uses a single, technical session cookie (form protection, language). No analytics, no resources loaded from third parties.